JSM SLA Sending OpsGenie Alerts Before SLA Breached

Question

We have our original SLA (8m) for "Time to Alert" configuration working correctly for email created incidents from the Azure email address.

I have added a new SLA (6m) for email created incidents from our Barracuda email address.

The JSM tickets all appear to be created correctly from this email address, and appear to be getting the correct SLA assigned based on the information in the queue.  The queue does not show the SLA as having breached, but OpsGenie is receiving an alert immediately when the ticket is created.  I've compared the automation rules for the existing Azure alert that is working and the new one and I don't see any differences in the logic.

The only thing I do see is that there is only one Automation rule for "when SLA breached" and it is only configured for the Azure email address, and only updates a label on the ticket.  I didn't think this should cause the issue because this rule shouldn't run until an SLA is actually breached.

Any ideas what configuration I am missing to get the new ticket to acknowledge the SLA that's configured?

I'll upload some screenshots.

unknown · Answer

The SLA was working correctly.  The issue was not understanding how to control the JSM to OpsGenie integration.  JSM sends updates to OpsGenie immediately upon opening a ticket from an email, not based on the SLA itself.  So the restriction on opening a ticket is managed on the OpsGenie side based on an action in JSM that happens only when the SLA is breached.

Issue resolution required 2 parts -

* New automation rule in JSM for "when SLA breached" that filters based on the unique reporter email address and that adds a new label value to the ticket.
* Update the OpsGenie Inbound automation rule for the Integration for this unique reporter to only create a ticket when the label is set.

unknown · Answer